I can't change my DNS server

Lowyat.NET Lowyat.NET Rules and Regulations

FAQ Help Search Members Calendar

Outline · [ Standard ] · Linear+

I can't change my DNS server

Share on

| Track this topic | Email this topic | Print this topic

viledante

Sep 27 2008, 02:16 AM

Show posts by this member only |This post's rating (0+, 0-) | Post #1

Casual

Group: Junior Member
Posts: 324
Ratings earned: 0+, 0-
Ratings given: 0+, 0-

Joined: Nov 2007
From: Perlis

OK, here is the problem.

I've been suffering can't access to some site like shoutmix.com and nuffnang.com
so, I checked my internet setting, and I noticed this.
user posted image

I change back to automatically, then when I looked back, its change back to the way it was.
even when I'm change it back again, its still remains the same.

but I still can access to some site likes lyn gmail n others.
except for nuffnang and shoutmix.

prasys

Sep 27 2008, 09:01 AM

Show posts by this member only |This post's rating (0+, 0-) | Post #2

<3 Bastila
Group Icon

Group: Staff
Posts: 10,709
Ratings earned: 0+, 0-
Ratings given: 0+, 0-

Joined: Mar 2005
From: Kuala Lumpur

Whoops you have been infected by zlob-dns. Its a nasty spyware that changes your DNS Address. Pretty much you're using their DNS Server to go through things which is way too dangerous as quires are sent through their DNS Server.

I would RECOMMEND you to disconnect the PC from the Internet and follow this guide (which I found through Yahoo Answers)

http://answers.yahoo.com/question/index?qi...15213722AA4wqjY

Thread moved

francischuahcw

Sep 27 2008, 09:04 AM

Show posts by this member only |This post's rating (0+, 0-) | Post #3

Retired. Do Not Disturb

Group: Senior Member
Posts: 2,114
Ratings earned: 0+, 0-
Ratings given: 0+, 0-

Joined: Feb 2006

QUOTE(viledante @ Sep 27 2008, 02:16 AM)

OK, here is the problem.

I've been suffering can't access to some site like shoutmix.com and nuffnang.com
so, I checked my internet setting, and I noticed this.
user posted image

I change back to automatically, then when I looked back, its change back to the way it was.
even when I'm change it back again, its still remains the same.

but I still can access to some site likes lyn gmail n others.
except for nuffnang and shoutmix.

Hi there TS,
Your computer has been infected with WareOut infection.

Please post your HijackThis!Log here. If you do not have it, follow below instruction

Download HijackThis
Download HiJackThis v2.0.2 from Here
NOTE: Please uninstall any older version of HiJackThis first.

Save HJTInstall.exe to your desktop
Double click on the HJTInstall.exe icon on your desktop
By default it will install to C:\Program Files\Trend Micro\HijackThis
Click on Install ...it will create a HiJackThis icon on the desktop
Once installed, it will launch HijackThis...if not...double click the HijackThis desktop icon
Important! If using Windows Vista, be sure to Run as Administrator.
Click on the "Do a system scan and save a Log file"...button. When the scan is finished...
Notepad will open with a saved log file called "hijackthis.log"
In the Hijackthis log, go to the top menu, click on "Format" and uncheck "Word Wrap" if checked.
Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
Paste the contents of hijackthis.log file in your next reply.

Do not fix anything yourself...most entries are needed to run your computer.
Removing any needed entries... your computer could become inoperable!.

Please be patient while waiting for help. Forum expert will help you out with your log soon.

Thanks

This post has been edited by francischuahcw: Sep 27 2008, 09:05 AM

viledante

Sep 27 2008, 09:24 AM

Show posts by this member only |This post's rating (0+, 0-) | Post #4

Casual

Group: Junior Member
Posts: 324
Ratings earned: 0+, 0-
Ratings given: 0+, 0-

Joined: Nov 2007
From: Perlis

QUOTE(prasys @ Sep 27 2008, 09:01 AM)

Whoops you have been infected by zlob-dns. Its a nasty spyware that changes your DNS Address. Pretty much you're using their DNS Server to go through things which is way too dangerous as quires are sent through their DNS Server.

I would RECOMMEND you to disconnect the PC from the Internet and follow this guide (which I found through Yahoo Answers)

http://answers.yahoo.com/question/index?qi...15213722AA4wqjY

Thread moved

OMG, if I login to some site, its will save my private data or anything?

QUOTE(francischuahcw @ Sep 27 2008, 09:04 AM)

Hi there TS,
Your computer has been infected with WareOut infection.

Please post your HijackThis!Log here. If you do not have it, follow below instruction

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:22:52 AM, on 9/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

» Click to show Spoiler - click again to hide... «

francischuahcw

Sep 27 2008, 09:56 AM

Show posts by this member only |This post's rating (0+, 0-) | Post #5

Retired. Do Not Disturb

Group: Senior Member
Posts: 2,114
Ratings earned: 0+, 0-
Ratings given: 0+, 0-

Joined: Feb 2006

Hi there TS,
some searching told me that the IP address is somewhere from Ukraine.
http://whois.domaintools.com/85.255.116.162

This is the second WareOut infection case that posted here within 2 days time.
The other one will be below link
http://forum.lowyat.net/index.php?showtopic=800190&hl=

viledante

Sep 27 2008, 11:11 AM

Show posts by this member only |This post's rating (0+, 0-) | Post #6

Casual

Group: Junior Member
Posts: 324
Ratings earned: 0+, 0-
Ratings given: 0+, 0-

Joined: Nov 2007
From: Perlis

problem solved!
thanks francis and fenzo.

I used the method that francis gave.
thank you so much guys!

« Next Oldest · Technical Support · Next Newest »